linux-kernel - Re: [syzbot] net-next test error: WARNING in __napi

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Sat, 19 Mar 2022 02:51:35 -0700
From:   syzbot <syzbot+fb57d2a7c4678481a495@...kaller.appspotmail.com>
To:     Hillf Danton <hdanton@...a.com>
Cc:     bigeasy@...utronix.de, hdanton@...a.com,
        linux-kernel@...r.kernel.org, netdev@...r.kernel.org,
        syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] net-next test error: WARNING in __napi_schedule

> On Fri, 18 Mar 2022 16:36:19 -0700
>> Hello,
>> 
>> syzbot found the following issue on:
>> 
>> HEAD commit:    e89600ebeeb1 af_vsock: SOCK_SEQPACKET broken buffer test
>> git tree:       net-next
>> console output: https://syzkaller.appspot.com/x/log.txt?x=134d43d5700000
>> kernel config:  https://syzkaller.appspot.com/x/.config?x=ef691629edb94d6a
>> dashboard link: https://syzkaller.appspot.com/bug?extid=fb57d2a7c4678481a495
>> compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
>> 
>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
>> Reported-by: syzbot+fb57d2a7c4678481a495@...kaller.appspotmail.com
>> 
>> ------------[ cut here ]------------
>> WARNING: CPU: 0 PID: 1133 at net/core/dev.c:4268 ____napi_schedule net/core/dev.c:4268 [inline]
>> WARNING: CPU: 0 PID: 1133 at net/core/dev.c:4268 __napi_schedule+0xe2/0x440 net/core/dev.c:5878
>> Modules linked in:
>> CPU: 0 PID: 1133 Comm: kworker/0:3 Not tainted 5.17.0-rc8-syzkaller-02525-ge89600ebeeb1 #0
>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
>> Workqueue: wg-crypt-wg0 wg_packet_decrypt_worker
>> RIP: 0010:____napi_schedule net/core/dev.c:4268 [inline]
>> RIP: 0010:__napi_schedule+0xe2/0x440 net/core/dev.c:5878
>> Code: 74 4a e8 31 16 47 fa 31 ff 65 44 8b 25 47 c5 d0 78 41 81 e4 00 ff 0f 00 44 89 e6 e8 98 19 47 fa 45 85 e4 75 07 e8 0e 16 47 fa <0f> 0b e8 07 16 47 fa 65 44 8b 25 5f cf d0 78 31 ff 44 89 e6 e8 75
>> RSP: 0018:ffffc900057d7c88 EFLAGS: 00010093
>> RAX: 0000000000000000 RBX: ffff88801e680748 RCX: 0000000000000000
>> RDX: ffff88801ccb0000 RSI: ffffffff8731aa92 RDI: 0000000000000003
>> RBP: 0000000000000200 R08: 0000000000000000 R09: 0000000000000001
>> R10: ffffffff8731aa88 R11: 0000000000000000 R12: 0000000000000000
>> R13: ffff8880b9c00000 R14: 000000000003adc0 R15: ffff88801e118ec0
>> FS:  0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
>> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> CR2: 00007fdaa5c65300 CR3: 0000000070af4000 CR4: 00000000003506f0
>> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
>> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
>> Call Trace:
>>  <TASK>
>>  napi_schedule include/linux/netdevice.h:465 [inline]
>>  wg_queue_enqueue_per_peer_rx drivers/net/wireguard/queueing.h:204 [inline]
>>  wg_packet_decrypt_worker+0x408/0x5d0 drivers/net/wireguard/receive.c:510
>>  process_one_work+0x9ac/0x1650 kernel/workqueue.c:2307
>>  worker_thread+0x657/0x1110 kernel/workqueue.c:2454
>>  kthread+0x2e9/0x3a0 kernel/kthread.c:377
>>  ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
>>  </TASK>
>
> See if what was added in fbd9a2ceba5c ("net: Add lockdep asserts to ____napi_schedule().")
> makes sense given irq disabled.
>
> Hillf
>
> #syz test: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/  e89600ebeeb1

This crash does not have a reproducer. I cannot test it.

>
> --- x/net/core/dev.c
> +++ y/net/core/dev.c
> @@ -4265,8 +4265,8 @@ static inline void ____napi_schedule(str
>  {
>  	struct task_struct *thread;
>  
> -	lockdep_assert_softirq_will_run();
>  	lockdep_assert_irqs_disabled();
> +	lockdep_assert_softirq_will_run();
>  
>  	if (test_bit(NAPI_STATE_THREADED, &napi->state)) {
>  		/* Paired with smp_mb__before_atomic() in
> --